class_docstr: Implementation of methods in Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks.
  Wang et al. (2019).
  
  | Paper link: https://people.cs.uchicago.edu/~ravenben/publications/pdf/backdoor-sp19.pdf
class_docstr_tok: ["Implementation","of","methods","in","Neural","Cleanse",":","Identifying","and","Mitigating","Backdoor","Attacks","in","Neural","Networks",".","Wang","et","al",".","(","2019",")",".","|","Paper","link",":","https",":","\/\/people.cs.uchicago.edu\/~ravenben\/publications\/pdf\/backdoor-sp19.pdf"]
docstr: Mitigates the effect of poison on a classifier
  
  :param x_val: Validation data to use to mitigate the effect of poison.
  :param y_val: Validation labels to use to mitigate the effect of poison.
  :param mitigation_types: The types of mitigation method, can include 'unlearning', 'pruning', or 'filtering'
  :return: Tuple of length 2 of the selected class and certified radius.
docstr_tok: ["Mitigates","the","effect","of","poison","on","a","classifier",":","param","x_val",":","Validation","data","to","use","to","mitigate","the","effect","of","poison",".",":","param","y_val",":","Validation","labels","to","use","to","mitigate","the","effect","of","poison",".",":","param","mitigation_types",":","The","types","of","mitigation","method",",","can","include","'unlearning","'",",","'pruning","'",",","or","'filtering'",":","return",":","Tuple","of","length","2","of","the","selected","class","and","certified","radius","."]
code: def mitigate(
      self,
      x_val: np.ndarray,
      y_val: np.ndarray,
      mitigation_types: List[str],
  ) -> None:
      """
      Mitigates the effect of poison on a classifier
  
      :param x_val: Validation data to use to mitigate the effect of poison.
      :param y_val: Validation labels to use to mitigate the effect of poison.
      :param mitigation_types: The types of mitigation method, can include 'unlearning', 'pruning', or 'filtering'
      :return: Tuple of length 2 of the selected class and certified radius.
      """
      (
          clean_data,
          backdoor_data,
          backdoor_labels,
      ) = self.backdoor_examples(x_val, y_val)
  
      # If no backdoors detected from outlier detection, do nothing
      if len(backdoor_data) == 0:
          logger.info("No backdoor labels were detected")
          return
  
      if (
          "pruning" in mitigation_types
          or "filtering" in mitigation_types
      ):
          # get activations from penultimate layer from clean and backdoor images
          clean_activations = self._get_penultimate_layer_activations(
              clean_data
          )
          backdoor_activations = (
              self._get_penultimate_layer_activations(backdoor_data)
          )
  
          # rank activations descending by difference in backdoor and clean inputs
          ranked_indices = np.argsort(
              np.sum(clean_activations - backdoor_activations, axis=0)
          )
  
      for mitigation_type in mitigation_types:
          if mitigation_type == "unlearning":
              # Train one epoch on generated backdoors
              # This mitigation method works well for Trojan attacks
  
              self._fit_classifier(
                  backdoor_data,
                  backdoor_labels,
                  batch_size=1,
                  nb_epochs=1,
              )
  
          elif mitigation_type == "pruning":
              # zero out activations from highly ranked neurons until backdoor is unresponsive
              # This mitigation method works well for backdoors.
  
              backdoor_effective = self.check_backdoor_effective(
                  backdoor_data, backdoor_labels
              )
              num_neurons_pruned = 0
              total_neurons = clean_activations.shape[1]
  
              # starting from indices of high activation neurons, set weights (and biases) of high activation
              # neurons to zero, until backdoor ineffective or pruned 30% of neurons
              logger.info("Pruning model...")
              while (
                  backdoor_effective
                  and num_neurons_pruned < 0.3 * total_neurons
                  and num_neurons_pruned < len(ranked_indices)
              ):
                  self._prune_neuron_at_index(
                      ranked_indices[num_neurons_pruned]
                  )
                  num_neurons_pruned += 1
                  backdoor_effective = self.check_backdoor_effective(
                      backdoor_data, backdoor_labels
                  )
              logger.info(
                  "Pruning complete. Pruned %d neurons",
                  num_neurons_pruned,
              )
  
          elif mitigation_type == "filtering":
              # using top 1% of ranked neurons by activation difference to adv vs. clean inputs
              # generate a profile of average activation, when above threshold, abstain
  
              # get indices of top 1% of ranked neurons
              num_top = int(np.ceil(len(ranked_indices) * 0.01))
              self.top_indices = ranked_indices[:num_top].tolist()
  
              # measure average activation for clean images and backdoor images
              avg_clean_activation = np.average(
                  clean_activations[:, self.top_indices], axis=0
              )
              std_clean_activation = np.std(
                  clean_activations[:, self.top_indices], axis=0
              )
  
              # if average activation for selected neurons is above a threshold, flag input and abstain
              # activation over threshold function can be called at predict
              # TODO: explore different values for threshold
              self.activation_threshold = (
                  avg_clean_activation + 1 * std_clean_activation
              )
  
          else:  # pragma: no cover
              raise TypeError(
                  "Mitigation type: `"
                  + mitigation_type
                  + "` not supported"
              )
  
file_path: adversarial-robustness-toolbox/art/estimators/poison_mitigation/neural_cleanse/neural_cleanse.py
imports: from __future__ import absolute_import, division, print_function, unicode_literals
  import logging
  from typing import Union, Tuple, List
  import numpy
  from art.estimators.certification.abstain import AbstainPredictorMixin
  from art.utils import to_categorical
label_desc: Use image node_id 7 for calling the NeuralCleanseMixin obj's underlying member method code with example usage: obj.mitigate(x_val, y_val, mitigation_types) without return types